Question

What’s the best way to protect against dynamic file access using URL variables? I’m concatenating two URL variables that will form the filename I want to access which will load XML.

$type = $_REQUEST['type']
//(ie. AB);
$timeframe = $_REQUEST['timeframe']
//(ie. 00.04);

//create XML document object model (DOM)
$main_doc = new DOMDocument();
$s = SITE_DIR."/data/file.".$type.".".$timeframe.".xml"; 
// example file.AB.00.04.xml)
// will be adding test to see if file exists
$main_doc->load($s);

Answer 1

You should check that the request string does not contain “..” and also doesn’t contain “/” (or “\” if you’re on windows) so that the path does not point to a directory other than one you are referencing.

Perhaps try this:

$timeframe = str_replace(array('..','/','\'),array('','',''),$timeframe);